Exploitation Summary
EIP tracks 1 public exploit for EIP-2026-111326. PoCs published by Touhid M.Shaikh.
AI-analyzed exploit summary This exploit leverages the PlaySMS 1.4 admin log functionality to achieve remote code execution by injecting malicious PHP code into the User-Agent header, which is then rendered in the admin's 'Whose Online' panel.
Description
PlaySMS 1.4 - Remote Code Execution
Exploits (1)
exploitdb
WORKING POC
by Touhid M.Shaikh · textwebappsphp
https://www.exploit-db.com/exploits/42038
This exploit leverages the PlaySMS 1.4 admin log functionality to achieve remote code execution by injecting malicious PHP code into the User-Agent header, which is then rendered in the admin's 'Whose Online' panel.
Classification
Working Poc 90%
Attack Type
Rce
Complexity
Trivial
Reliability
Reliable
Target:
PlaySMS 1.4
Auth required
Prerequisites:
Valid user credentials to log in · Admin must view the 'Whose Online' panel
devstral-2 · analyzed Feb 18, 2026
Full analysis →
Details
Status
pre_cve
Tracked Since
Feb 18, 2026